> ## Documentation Index
> Fetch the complete documentation index at: https://levelblue-final.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Events, Alarms, and Notifications Created When a User's Status Changes

USM Anywhere enables you to configure alarms (Alarms provide notification of an event or sequence of events that require attention or investigation.) to alert you when a user's entity or account status changes. USM Anywhere generates monitoring events (Process of collecting all device status and event information and processing normalized events for evidence of vulnerabilities, possible attacks, and other malicious activity.) that display in the Events List View page. See [Events List View](https://levelblue-final.mintlify.site/documentation/usm-anywhere/user-guide/events/events-list-view.md) for more information. You can see two types of monitoring events related to User Behavior Analytics (UBA) user status: *user status changed* and *account status changed*. From these events, you may configure alarm rules to alert you when these status changes trigger events.

**To see events created when a user entity or account status changes**

1. Go to **Settings > System Events**.

2. Locate the Event Name filter and select either **User Status Changed** or **Account Status Changed**.

   ![](https://mintcdn.com/levelblue-final/5CO-AvNLSpisHL76/images/usm-anywhere/user-guide/user-behavior-analytics/userstatuschanged.webp?fit=max\&auto=format\&n=5CO-AvNLSpisHL76\&q=85\&s=3d5f46910321947e3b9749ddd91dca46)

   The result displays the filtered events.

3. Click the event to see its details.

**To create alarm rules when a user entity or account status changes**

1. Go to **Settings > Rules** and either:

   * Click **Create Orchestration Rule > Create Alarm Rule**.
   * Or click **Alarm Rules**, and then click **Create Alarm Rule**.

2. Populate the new alarm rule as described in [Alarm Rules](https://levelblue-final.mintlify.site/documentation/usm-anywhere/user-guide/rules-management/alarm-rules.md).

3. Under Rule Condition, use the Match drop-down list to select system\_events.

4. Click **Add Condition**.

5. Select **Event Name**, then **Equals**, and then either **User Status Changed** or **Account Status Changed**.

   ![](https://mintcdn.com/levelblue-final/5CO-AvNLSpisHL76/images/usm-anywhere/user-guide/user-behavior-analytics/user-status-rule-condition.jpeg?fit=max\&auto=format\&n=5CO-AvNLSpisHL76\&q=85\&s=f87f4522d07d6653ab5613f55408d611)

6. Click **Save Rule**.

   The alarm rule has been created. You can see it from **Settings > Rules**. See [Alarm Rules from the Orchestration Rules Page](https://levelblue-final.mintlify.site/documentation/usm-anywhere/user-guide/rules-management/alarm-rules.md) for more information.

   > [!WARNING]
   >
   > **Important:** It takes a few minutes for an orchestration rule to become active.